Businesses and organizations today are becoming increasingly dependent on various forms of electronic communication such as email, instant messaging, etc. The same characteristics that make electronic messages popular—speed and convenience—also make them prone to misuse. Confidential or inappropriate information can be easily leaked from within an organization. A breach of confidential information may be caused inadvertently or purposefully. Unauthorized information transmission can lead to direct harm such as lost revenue, theft of intellectual property, additional legal cost, as well as indirect harm such as damage to the company's reputation and image.
Although some studies show that over half of information security incidents are initiated from within organizations, currently security products for preventing internal security breaches tend to be less sophisticated and less effective than products designed to prevent external break-ins such as spam filters, intrusion detection systems, firewalls, etc. There are a number of issues associated with the typical internal security products that are currently available. Some of the existing products that prevent inappropriate email from being sent use filters to match keywords or regular expressions. Since system administrators typically configure the filters to block specific keywords or expressions manually, the configuration process is often labor intensive and error-prone.
Other disadvantages of the keyword and regular expression identification techniques include high rate of false positives (i.e. legitimate email messages being identified as inappropriate for distribution). Additionally, someone intent on circumventing the filters can generally obfuscate the information using tricks such as word scrambling or letter substitution. In existing systems, the sender of a message is in a good position to judge how widely certain information can be circulated. However, the sender often has little control over the redistribution of the information.
It would be desirable to have a product that could more accurately and efficiently detect protected information in electronic messages and prevent inappropriate distribution of such information. It would also be useful if the product could give message senders greater degrees of control over information redistribution, as well as identify messages that are sent between different parts of an organization.